nolo-cli 0.95.0-alpha.6 → 0.95.0

package/{chunk-53HEEOTT.js → chunk-O26PCYLS.js}

@@ -11,13 +11,13 @@ import {
   getAntigravityUserAgent,
   normalizeAntigravityTokenPayload,
   refreshAntigravityToken
-} from "./chunk-UZGQNTVW.js";
-import {
-  writeOAuthCredential
-} from "./chunk-ONXOABJR.js";
+} from "./chunk-S5XGT6GB.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
+import {
+  writeOAuthCredential
+} from "./chunk-HNGRBWYF.js";
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";
@@ -367,6 +367,77 @@ async function refreshAntigravityOAuthToken(credential, deps = {}) {
 // packages/cli/oauth/flows/openai-codex.ts
 import { createHash as createHash2 } from "node:crypto";
 
+// packages/agent-runtime/oauthRefreshError.ts
+var PERMANENT_REFRESH_CODES = /* @__PURE__ */ new Set([
+  "invalid_grant",
+  // OpenAI 令牌端点对失效/不存在的 refresh token 返回 401
+  // {"error":{"code":"invalid_refresh_token",...}}（2026-10-01 用必然无效的
+  // token 实测）。线上 chatgpt 凭据正是因为没认出它，被当成临时的
+  // "unauthorized"、每 15 分钟重试一次且永远不提示重新授权。
+  "invalid_refresh_token",
+  "refresh_token_reused",
+  "invalid_client"
+]);
+var SAFE_MESSAGES = {
+  invalid_grant: "refresh token \u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  invalid_refresh_token: "refresh token \u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  refresh_token_reused: "refresh token \u5DF2\u88AB\u5176\u4ED6\u526F\u672C\u4F7F\u7528\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  invalid_client: "OAuth \u5BA2\u6237\u7AEF\u88AB\u62D2\u7EDD\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  unauthorized: "\u4E0A\u6E38\u62D2\u7EDD\u4E86\u5237\u65B0\u8BF7\u6C42\uFF08401/403\uFF09",
+  rate_limited: "\u4E0A\u6E38\u9650\u6D41\uFF0C\u7A0D\u540E\u91CD\u8BD5",
+  http_5xx: "\u4E0A\u6E38\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528",
+  network: "\u65E0\u6CD5\u8FDE\u63A5\u4E0A\u6E38",
+  bad_response: "\u4E0A\u6E38\u8FD4\u56DE\u4E86\u65E0\u6CD5\u8BC6\u522B\u7684\u54CD\u5E94",
+  unknown: "\u5237\u65B0\u5931\u8D25"
+};
+var OAuthRefreshError = class extends Error {
+  code;
+  status;
+  retryAfterMs;
+  constructor(code, opts = {}) {
+    super(SAFE_MESSAGES[code]);
+    this.name = "OAuthRefreshError";
+    this.code = code;
+    if (opts.status !== void 0) this.status = opts.status;
+    if (opts.retryAfterMs !== void 0) this.retryAfterMs = opts.retryAfterMs;
+  }
+  get permanent() {
+    return PERMANENT_REFRESH_CODES.has(this.code);
+  }
+};
+function readErrorCode(payload) {
+  if (!payload || typeof payload !== "object") return void 0;
+  const err = payload.error;
+  if (typeof err === "string") return err;
+  if (err && typeof err === "object") {
+    const code = err.code;
+    if (typeof code === "string") return code;
+  }
+  return void 0;
+}
+function classifyOAuthRefreshHttpFailure(status, payload, headers) {
+  const raw = readErrorCode(payload)?.toLowerCase();
+  if (raw === "invalid_grant") return new OAuthRefreshError("invalid_grant", { status });
+  if (raw === "invalid_refresh_token") {
+    return new OAuthRefreshError("invalid_refresh_token", { status });
+  }
+  if (raw === "refresh_token_reused") {
+    return new OAuthRefreshError("refresh_token_reused", { status });
+  }
+  if (raw === "invalid_client") return new OAuthRefreshError("invalid_client", { status });
+  if (status === 429) {
+    const seconds = Number(headers?.get("retry-after"));
+    return new OAuthRefreshError("rate_limited", {
+      status,
+      ...Number.isFinite(seconds) && seconds > 0 ? { retryAfterMs: seconds * 1e3 } : {}
+    });
+  }
+  if (status === 401 || status === 403) return new OAuthRefreshError("unauthorized", { status });
+  if (status >= 500) return new OAuthRefreshError("http_5xx", { status });
+  return new OAuthRefreshError("unknown", { status });
+}
+var TRANSIENT_MAX_MS = 15 * 6e4;
+
 // packages/agent-runtime/openaiCodexOAuth.ts
 var OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 var OPENAI_CODEX_SCOPES = [
@@ -463,17 +534,14 @@ async function refreshOpenAiCodexToken(credential, deps = {}) {
       signal: AbortSignal.timeout(OPENAI_CODEX_TOKEN_REQUEST_TIMEOUT_MS)
     });
   } catch (error) {
-    throw new Error(
-      `OpenAI Codex token refresh failed: ${toErrorMessage(error)}`
-    );
+    throw new OAuthRefreshError("network");
   }
   const payload = await response.json().catch(() => ({}));
   if (!response.ok) {
-    const detail = typeof payload.error_description === "string" && payload.error_description ? payload.error_description : typeof payload.error === "string" && payload.error ? payload.error : `HTTP ${response.status}`;
-    throw new Error(`OpenAI Codex token refresh failed: ${detail}`);
+    throw classifyOAuthRefreshHttpFailure(response.status, payload, response.headers);
   }
   if (typeof payload.access_token !== "string" || !payload.access_token.trim()) {
-    throw new Error("OpenAI Codex token refresh response missing access_token");
+    throw new OAuthRefreshError("bad_response");
   }
   const now = deps.now?.() ?? Date.now();
   return normalizeOpenAiCodexTokenPayload({
@@ -1047,11 +1115,10 @@ async function refreshAnthropicToken(credential, deps = {}) {
   });
   const payload = await response.json().catch(() => ({}));
   if (!response.ok) {
-    const detail = typeof payload.error_description === "string" ? payload.error_description : typeof payload.error === "string" ? payload.error : `HTTP ${response.status}`;
-    throw new Error(`Claude token refresh failed: ${detail}`);
+    throw classifyOAuthRefreshHttpFailure(response.status, payload, response.headers);
   }
   if (typeof payload.access_token !== "string" || !payload.access_token.trim()) {
-    throw new Error("Claude token refresh response missing access_token");
+    throw new OAuthRefreshError("bad_response");
   }
   const now = deps.now?.() ?? Date.now();
   return normalizeAnthropicTokenPayload({

package/{chunk-3DII57IT.js → chunk-O2OWEFII.js}

@@ -1,7 +1,7 @@
 import {
   DEFAULT_AGENT_BASE_POLICY,
   DEFAULT_USER_PREFERENCE_PROFILE
-} from "./chunk-AFUORTY4.js";
+} from "./chunk-SONWNI3L.js";
 
 // packages/ai/policy/runtimePolicy.ts
 var clampLevel = (value, fallback) => {

package/chunk-OCZKATRC.js

@@ -0,0 +1,129 @@
+// packages/ai/chat/parseApiError.ts
+var CONTEXT_OVERFLOW_ACTIONS = [
+  "compact-and-retry",
+  "new-dialog",
+  "switch-model",
+  "retry"
+];
+var CONTEXT_TOO_LARGE_ACTIONS = [
+  "new-dialog",
+  "switch-model",
+  "retry"
+];
+var truncateErrorMessage = (message, maxChars = 320) => message.length <= maxChars ? message : `${message.slice(0, maxChars)}\u2026`;
+var isContextOverflowText = (message) => /maximum context|context (length|window|overflow|limit)|context_length_exceed\w*|requested about .*tokens|too many tokens|prompt is too long|exceeds? (the )?(model|max)/i.test(
+  message
+);
+function classifyApiError(input) {
+  const { status, message, body, code } = input;
+  const errorMessage = message;
+  let defaultMessage = `\u72B6\u6001\u7801 ${status} ${input.statusText ?? ""}`;
+  switch (status) {
+    case 400:
+      if (isContextOverflowText(errorMessage) || isContextOverflowText(body) || code === "UPSTREAM_400") {
+        return {
+          kind: "context_overflow",
+          message: "\u4E0A\u4E0B\u6587\u8FC7\u957F\uFF1A\u672C\u8F6E\u6D88\u606F\u6216\u5DE5\u5177\u7ED3\u679C\u592A\u5927\u3002\u8BF7\u7F29\u5C0F\u8303\u56F4\uFF0C\u6216\u5148\u8BFB\u53D6\u66F4\u5C0F\u7247\u6BB5\u540E\u518D\u7EE7\u7EED\u3002",
+          code,
+          status,
+          retryable: true,
+          actions: [...CONTEXT_OVERFLOW_ACTIONS]
+        };
+      }
+      if (code === "MISSING_PROVIDER_API_KEY") {
+        return {
+          kind: "generic",
+          message: truncateErrorMessage(errorMessage),
+          code,
+          status,
+          retryable: false
+        };
+      }
+      if (errorMessage && errorMessage !== defaultMessage) {
+        return {
+          kind: "generic",
+          message: `\u8BF7\u6C42\u53C2\u6570\u9519\u8BEF: ${truncateErrorMessage(errorMessage)}`,
+          code,
+          status,
+          retryable: false
+        };
+      }
+      return { kind: "generic", message: "\u8BF7\u6C42\u53C2\u6570\u9519\u8BEF\uFF0C\u8BF7\u68C0\u67E5\u8F93\u5165", code, status, retryable: false };
+    case 413:
+      return {
+        kind: "context_too_large",
+        message: "\u8BF7\u6C42\u5185\u5BB9\u8FC7\u5927\uFF1A\u8BF7\u51CF\u5C11\u4E00\u6B21\u53D1\u9001\u7684\u6D88\u606F\u3001\u6587\u4EF6\u6216\u5DE5\u5177\u7ED3\u679C\u3002",
+        code,
+        status,
+        retryable: true,
+        actions: [...CONTEXT_TOO_LARGE_ACTIONS]
+      };
+    case 401:
+      return {
+        kind: "auth",
+        message: code === "AUTH_TOKEN_EXPIRED" ? "\u767B\u5F55\u72B6\u6001\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u5148\u767B\u51FA\u540E\u91CD\u65B0\u767B\u5F55" : code === "AUTH_ACCOUNT_INVALID" ? "\u8D26\u6237\u65E0\u6548\u6216\u5DF2\u88AB\u505C\u7528\uFF0C\u8BF7\u8054\u7CFB\u7BA1\u7406\u5458" : code === "AUTH_NO_TOKEN" ? "\u672A\u68C0\u6D4B\u5230\u767B\u5F55\u72B6\u6001\uFF0C\u8BF7\u5148\u767B\u5F55" : code === "AUTH_INVALID_TOKEN" ? "\u767B\u5F55\u51ED\u8BC1\u65E0\u6548\uFF0C\u8BF7\u5148\u767B\u51FA\u540E\u91CD\u65B0\u767B\u5F55" : code === "AUTH_TOKEN_NOT_ACTIVE" ? "\u4EE4\u724C\u5C1A\u672A\u751F\u6548\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5" : errorMessage && errorMessage !== `\u72B6\u6001\u7801 401 Unauthorized` ? `\u8BA4\u8BC1\u9519\u8BEF: ${truncateErrorMessage(errorMessage)}` : "\u8EAB\u4EFD\u9A8C\u8BC1\u5931\u8D25\uFF0C\u8BF7\u5148\u767B\u51FA\u540E\u91CD\u65B0\u767B\u5F55",
+        code,
+        status,
+        retryable: true,
+        actions: ["retry"]
+      };
+    case 503:
+      return {
+        kind: "server",
+        message: errorMessage && errorMessage !== `\u72B6\u6001\u7801 503 Service Unavailable` ? truncateErrorMessage(errorMessage) : "\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5",
+        code,
+        status,
+        retryable: true,
+        actions: ["retry"]
+      };
+    case 504:
+      return {
+        kind: "timeout",
+        message: "\u8BF7\u6C42\u8D85\u65F6\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5",
+        code,
+        status,
+        retryable: true,
+        actions: ["retry"]
+      };
+    default:
+      return {
+        kind: "generic",
+        message: `API\u8BF7\u6C42\u5931\u8D25: ${truncateErrorMessage(errorMessage)}`,
+        code,
+        status,
+        retryable: true,
+        actions: ["retry"]
+      };
+  }
+}
+async function parseApiErrorInfo(response) {
+  const errorBody = await response.text();
+  let errorMessage = `\u72B6\u6001\u7801 ${response.status} ${response.statusText}`;
+  let errorCode = `E${response.status}`;
+  try {
+    const errorJson = JSON.parse(errorBody);
+    errorMessage = errorJson?.error?.message || errorJson?.message || errorJson?.msg || errorBody || errorMessage;
+    errorCode = errorJson?.error?.code || errorJson?.code || errorCode;
+  } catch (_e) {
+    if (errorBody) {
+      errorMessage = errorBody;
+    }
+  }
+  return classifyApiError({
+    status: response.status,
+    statusText: response.statusText,
+    message: errorMessage,
+    body: errorBody,
+    code: errorCode
+  });
+}
+async function parseApiError(response) {
+  return (await parseApiErrorInfo(response)).message;
+}
+
+export {
+  CONTEXT_OVERFLOW_ACTIONS,
+  CONTEXT_TOO_LARGE_ACTIONS,
+  isContextOverflowText,
+  parseApiError
+};